3 ms·
My concern here is that, from the perspective of those looking for these, the relevant time spent is not only that spent on identifying this bug, but all the ti
by jonnycomputer 6y ago
My concern here is that, from the perspective of those looking for these, the relevant time spent is not only that spent on identifying this bug, but all the times spent looking for bugs where there were none, or where they didn't see them.
- jononor 6y agoMaybe bug bounty researchers should include this in their writeup that they send with the disclosure. Label it "security" testing, some details on what endpoints/methods where checked. Suggest a market value for this work, and say that an invoice with 50% rebate can be made out to cover it, if they wish. Need to word it carefully to avoid it sounding like a threat or demand. Intention would be to highlight the work put in and the value for the company, and make it as easy as possible to compensate that.